Question
Incessant Technologies
IN
Last activity: 3 Oct 2025 17:35 EDT
Connection to Juniper kafka using Kerboros authentication from Pega 23.1 hosted on GCP
Hi All, we are trying to connect to Juniper kafka using Kerboros authentication from Pega 23.1 hosted on GCP. However, getting socket timeout exception. Can someone please confirm, if pega supports kerboros authentication on 3rd party cloud. Read article that pega cloud does not support kerboros authentication.
Note :- I have configured all required jaas & krb5 files along with jvm args.
HCA Healthcare
US
yes, on self-managed deployments like yours on GCP, Pega 23.1 can connect to external Kafka using SASL/GSSAPI (Kerberos); the “not supported” note applies to Pega Cloud Managed Service, not to customer-hosted environments. Check basics first: brokers and the KDC/AD must be reachable from your pods/VMs (open TCP/UDP 88 and 464, DNS for the realm/SRV records, NTP clock sync) or you’ll see socket timeouts. In your Kafka config (rule or prconfig), set security.protocol=SASL_SSL, sasl.mechanism=GSSAPI, and sasl.kerberos.service.name=kafka. Provide a JAAS entry using Krb5LoginModule with useKeyTab=true, storeKey=true, principal, and keyTab; pass -Djava.security.auth.login.config and -Djava.security.krb5.conf, and set -Djavax.security.auth.useSubjectCredsOnly=false so the client uses the JAAS creds. Validate the principal/realm in krb5.conf and that the broker principal matches the service name. If it still times out, test from the same host with kinit and a vanilla kafka-console-consumer to isolate Kerberos vs. network, then enable client debug (sasl, kerberos) to see where the handshake fails. References: Pega threads confirming GSSAPI setup and the Pega Cloud limitation, plus Kafka GSSAPI guidance and what a socket timeout implies.